We've been working on PMG (Package Manager Guard) - an open-source tool that sits between you and your package manager to block malicious packages before installation.

The problem we're solving:
Traditional scanners run after npm install or in CI/CD. By then, postinstall hooks have already executed.
PMG checks packages against real-time threat intelligence before they download.

What it does:
- Intercepts package manager commands (npm, pip, yarn, pnpm, bun, uv, poetry)
- Checks against threat intel before installation
- Blocks known malicious packages, typosquats, and supply chain risks
- Clean packages proceed normally with zero friction

Looking for feedback on this and needed more real-world testing from professionals and developers.
Open to contributions and drop a ⭐if found useful.